A hacker intercepts network traffic to steal login credentials.

Intercepting traffic to capture credentials is commonly achieved throughpacket sniffing, which targets theData Link layer (Layer 2). Techniques such as ARP poisoning operate at this layer to redirect traffic to the attacker.

While credentials belong to applications, the interception itself occurs at Layer 2.